Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix and test the github admin route #1886

Merged
merged 5 commits into from
Aug 11, 2018
Merged

Fix and test the github admin route #1886

merged 5 commits into from
Aug 11, 2018

Conversation

paulmelnikow
Copy link
Member

@paulmelnikow paulmelnikow commented Aug 10, 2018 •
edited
Loading

Fix regressions in the github admin and token acceptor endpoints, introduced in #1813.

@paulmelnikow paulmelnikow added bug Bugs in badges and the frontend core Server, BaseService, GitHub auth, Shared helpers labels Aug 10, 2018
@shields-ci
Copy link

Warnings
⚠️

This PR modified helper functions in lib/ but not accompanying tests. That's okay so long as it's refactoring existing code.
Messages
📖

✨ Thanks for your contribution to Shields, @paulmelnikow!

Generated by 🚫 dangerJS

paulmelnikow
paulmelnikow commented Aug 10, 2018
View reviewed changes
services/github/auth/admin.spec.js
const serverSecrets = require('../../../lib/server-secrets')
const { setRoutes } = require('./admin')

function createAuthHeader({ username, password }) {
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's a bit annoying this must be done manually. We may want to consider a different request library like got or axios.

@paulmelnikow
Copy link
Member Author

Sentry issue: SHIELDS-1C

@paulmelnikow
Copy link
Member Author

Sentry issue: SHIELDS-1D

@paulmelnikow
Copy link
Member Author

Sentry issue: SHIELDS-1B

This was referenced Aug 10, 2018
Merged
Closed
@PyvesB
Copy link
Member

PyvesB commented Aug 10, 2018

@paulmelnikow I'll look at this in the morning if no one has done so in the meantime. 😉

@PyvesB
Copy link
Member

PyvesB commented Aug 11, 2018

What was the regression that was introduced? Was it the usage of crypto.timingSafeEqual? The Sentry logs would probably answser my question, but I don't think I have access to them! 😄

@paulmelnikow
Copy link
Member Author

What was the regression that was introduced? Was it the usage of crypto.timingSafeEqual?

Yes it was. That function accepts buffers, not strings, and does not accept undefined. There were actually two implementations of constEq in the codebase. Probably we could swap out the second for crypto.timingSafeEqual if we wrap some tests around isValidToken.

The Sentry logs would probably answser my question, but I don't think I have access to them! 😄

Indeed! It would be good to give access to more of the maintainers. I wonder if we were to write some guidelines, @espadrine would be open to adding more people.

PyvesB
PyvesB approved these changes Aug 11, 2018
View reviewed changes
Copy link
Member

@PyvesB PyvesB left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for clarifying. I'm happy with the changes!

@paulmelnikow
Copy link
Member Author

Thanks for reviewing!

@paulmelnikow paulmelnikow merged commit 39d3930 into badges:master Aug 11, 2018
@shields-deployment
Copy link

This pull request was merged to master branch. Now this change is waiting for deployment.
Deploys usually happen every few weeks. After deployment changes are copied to gh-pages branch.

This badge displays deployment status:

@paulmelnikow paulmelnikow deleted the fix-github-admin-route branch August 11, 2018 23:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@PyvesB PyvesB PyvesB approved these changes

Assignees
No one assigned
Labels
bug Bugs in badges and the frontend core Server, BaseService, GitHub auth, Shared helpers
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@paulmelnikow @shields-ci @PyvesB